THE COMMISSIONER FOR DATA PROTECTION AND FREEDOM OF INFORMATION
LfDI Baden-Württemberg · P.O. Box 10 29 32 ·D-70025 Stuttgart
File No. R 2497/1983
[…]
Complaint of , R 2497/1983
Dear Madam or Sir,
Having examined the facts of the case presented by both parties, we can
make the following detailed comments on the complaint proceedings against
conducted under the above-mentioned Ref. no.
I. The course of the procedure
The Baden-Wuerttemberg DPA (hereinafter: BW DPA) launched an
investigation based on the complaint of (hereinafter: the
Complainant) pursuant to Article 57(1)(f) of the General Data Protection
Regulation (hereinafter: GDPR).
[Please note that the related procedure regarding , national
Ref. no. ZSZZS.1116.2019, has been dealt with in the revised draft decision
IMI no. 173932]
On 15 October 2019, the Complainant lodged a complaint with the Data
Protection Authority of Poland, in which he presented that he requested
access to his personal data from (hereinafter: the Company), but
the company failed to comply with this request.
On 15 November 2019, the Polish Data Protection Authority initiated a
procedure to establish the lead supervisory authority and to ask to handle the
case on a local level in accordance with Article 56 of the GDPR. In the course
of this, it was established that the BW DPA is the lead supervisory authority in
the case because the main establishment of the company is based in
Renningen, Baden-Wuerttemberg.
1
By that time, the BW DPA had already received the complaint from the
complainant directly as well. On the basis of this complaint, already,
the BW DPA called upon the Company to make a statement by letter from 18
October 2019. The Company's statement was received by the BW DPA on 20
November 2019.
On 10 October 2019, the BW DPA also notified the Complainant that an
investigative procedure was launched on the basis of his complaint.
[On 19 March 2020, the BW DPA firstly issued a draft decision in the present
case (IMI no. 117327), involving the Polish DPA as (only) concerned DPA. At
the request of the colleagues from the Polish DPA, the procedure was
withdrawn on 26 March 2020 due to their inability to proceed with the draft
decisions as usual under the Covid-19 circumstances.
On 28 May 2020, the BW DPA issued the draft decision again (IMI no.
127906). The Polish DPA expressed a relevant and reasoned objection to the
draft on 4 June 2020. The BW DPA followed the remarks made in the relevant
and reasoned objection and therefore provided a revised draft decision. The
EDPB Internal Guidelines on the application of Article 60 GDPR state that in
the OSS and cooperation process, the focus of all SAs involved should be on
eliminating any deficiencies in the consensus-building process in such a way
that a consensual draft decision is the result. Therefore, the EDPB
recommends as a minimum standard that the LSA makes all efforts to
proactively share, with the other CSAs, the scope and main conclusions of its
draft decision prior to the formal submission of the latter. Following this
recommendation, the BW DPA shared the revised draft decision through
informal consultation with the Polish DPA as only CSA beforehand on 1 March
2021 (IMI no. A60IC 183421). The informal consultation procedure has been
closed without any comment made by the Polish DPA on 1 September 2021,
even after the BW DPA kindly reminded the Polish DPA to share their views
on 17 May 2021 (in IMI) and 28 July 2021 (via e-mail).
Subsequently, the BW DPA formally shared the revised draft decision in
accordance with Article 60(5) GDPR on 16 September 2021 (IMI no. A60RD
324143). Despite not having reacted to the informal consultation before, the
Polish DPA raised a reasoned and relevant objection to that revised draft
decision on 28 September 2021. Therefore, the BW DPA provides the current
re-revised draft decision.
However, please note that we understand the remark in the objection
reasoning in regards to as mistakenly made since the present case
is the case of . A data processing by did not take place
and would be in the jurisdiction of a different supervisory authority.]
II. Facts of the case
[For a full overview, please refer to the Company's statement uploaded in the
relevant documents in IMI]
2
The Complainant stated that between 4 April 2016 and 31 March 2019 he was
an employee of in Poland as IT network administrator on
the basis of a full-time employment contract. On 19 February 2019, the
employer submitted a statement on termination of the employment relationship
by the employer. During his work, the employer,
repeatedly delegated the Complainant to the following company
in Germany and to work in various positions. The
Complainant noted that provided IT services for
as well as , where he was employed. While working
for and , he registered coming in and out
using a magnetic card. He also stated that the buildings of and
premises are equipped with CCTV cameras, recording the
employees. Besides, at the company's operations are carried
out and backups of mailboxes are stored, including the Complainant's
electronic mailbox.
In their response, the Controller also briefly explained the structure within the
group of companies: The subsidiary operates the entire IT
infrastructure of the group of companies. Each company has its own access
and rights structures, which ensures that each company within the group only
accesses the data that is relevant to that company. This applies to productive
data as well as to employee data. The company is certified due to the
high secrecy requirements and the data separation procedure is a basic
requirement to obtain such a certificate. Even if the data is physically located
on an identical server, the information is still secured separately and thus
protected from unauthorised access. This means does not have
access to information from employees of other companies in the group, but
only the respective company to which the employee belongs. In this case, only
had access to the information (including mail or mailbox)
of the Complainant. Possible access data that were stored during the time of
his working period, in the premises of or , have a
retention period of 6 months and have therefore already been deleted a long
time ago.
ln his complaint submitted, the Complainant stated that he requested access
to his personal data and a gratuitous copy of his personal data processed in
that company by letter from 7 March 2019, sent with acknowledgement of
receipt on 8 March 2019. He claimed that he has not received a reply to the
date of his complaint.
In their response to the BW DPA, the Company confirmed that the
Complainant had been on site with the Company during a training period from
the subsidiary Poland, for 2 time periods, in
April and December 2016, for a maximum of 9 work days. It was stated that
the Complainant's request for access was sent to them on 7 March 2019, with
the request for confirmation as to whether personal data about his person is
stored. They also stated that the request was immediately processed on 29
March 2019 by Poland, which is the
Complainant's employer within the Group.
3
Due to this constellation, the Company considered the above-mentioned
procedure for answering the request for access to be sufficient at that time.
The Company apologised for this mistake and, however, provided the
requested information to the BW DPA which forwarded them to the
complainant accordingly.
As a general note, the Company also stated that data that were communicated
to them in connection with the Complainant's request for access would be
stored for proof purposes for a period of three years.
On 22 March 2021 the BW DPA received a letter from the Complainant in
reaction to our last letter to him. The BW DPA responded to that letter on 11
May 2021 and took into account the Complainant’s statements as follows:
1. In his letter, the Complainant referred to the fact that he had made two
complaints instead of only one, namely against and against
. He complained about the handling of the case through
the BW DPA, as we only referred to in our previous letter(s),
although the Company did not provide a mandate for acting in the name of
. The BW DPA explained to the Complainant that
is the controller as per Article 4(7) GDPR in this case,
whereas is (only) a processor as per Article 4(8) GDPR.
Both Article 12 and Article 15 GDPR rule that “the controller” is the party
who has to facilitate the exercise of data subject rights by providing
information on action taken on such a request, which the data subject has
the right to obtain. Therefore, the infringements regarding these provisions
only concern as controller.
2. The Complainant states in his letter that his two requests of 5 March 2019
to and pursuant to Article 15 of the
GDPR remained unanswered, indicating that he does not feel that the
Controller fulfilled his access request, also because the reply only stemmed
from and not also from . As stated above,
the obligation to fulfil data subject rights lies only with as
controller. In our letter, the BW DPA also explained that the fact that the
information was initially provided by in Poland does
indeed not comply with the legal requirements. apologised
for this mistake and subsequently provided the information immediately
(sent to the Complainant by post by the BW DPA on 25 February 2021).
The reason why the BW DPA submitted the information to the Complainant
is that the Company did in fact not have any more information stored about
the Complainant. Every information about the Complainant has been
deleted, which was also the content of the response to the access request.
Thus, the Company asked the BW DPA to submit the information following
the Article 15 request to the Complainant. The request for information was
fulfilled.
3. The Complainant also claimed that the Company made or relied upon
“wrong information” in its letter. He stated that the wrong date of the issuing
of his access requests, 5 March 2019 instead of 7 March 2019, was given.
The BW DPA explained to the Complainant that this appears only as a
4
mistake and that it does not change the facts of the case. The same
applies for the claims about the timing and quality of his work for
. Even if the dates about his work on site of the Company might
have been recalled wrongly, this does not change the assessment of the
case. In its response, states under point 2.1 that it no longer
stores any personal data about the Complainant. Accordingly, the
Company does not process any personal data from him either for the year
2016 or for the period 2017 and 2018. Also, the processing of employee
data is based on Section 26 of the German Data Protection Act, regardless
of the exact type of employment, due to the broad definition of ‘employee’
in Section 26(8) German Data Protection Act. Hence, defining his stay at
the Company as “training period” in the statement, is not relevant for the
case.
4. The Complainant criticised the fact that, contrary to what was announced,
the letter from the BW DPA lacked the statement from the Company. The
BW DPA apologised for that mistake and sent the letter once again to the
Complainant on 11 May 2021.
In addition to the information regarding the concrete case, the BW DPA
provided the Complainant with Guidelines about the cooperation mechanism,
the identification of the LSA and the concepts of controller and processor.
III. The findings of the Authority
Pursuant to Article 12(1) GDPR, the controller shall take appropriate measures
to provide any information referred to in Articles 13 and 14 and any
communication under Articles 15 to 22 and 34 relating to processing to the
data subject in a concise, transparent, intelligible and easily accessible form,
using clear and plain language. According to Article 12(3) GDPR, the
controller shall provide information on action taken on a request under Articles
15 to 22 to the data subject without undue delay and in any event within one
month of receipt of the request, whereby that period may be extended by two
further months where necessary, taking into account the complexity and
number of the requests.
The Company has not fulfilled the Complainant's request without undue delay,
as it did not respond to it within one month of receipt of the request. The
request was indeed received on 07 March 2019, whereas the Company only
sent the requested information to the BW DPA in their response from 20
November 2019.
It is not apparent that the Company was in a situation of Article 12(2) or (3)
GDPR. Firstly, the Company was able to identify the Complainant, meaning
that there was no reason for asking for further identification of the
Complainant. Secondly, the Company has not indicated that they process
such a wide scope and large number of data so as to request the Complainant
to specify his request.
5
Additionally, the Company did not inform the data subject within a month about
not taking action on the request together with reasons for not taking action as
requested by Article 12(4) GDPR.
By not having reacted to the Complainant's access request themselves and
without undue delay, they have infringed Article 15(1) and 15(3) GDPR as well
as Article 12(1) and (3) GDPR.
IV. Legal consequences
The BW DPA establishes that the Company breached Article 15(1) and (3) as
well as Article 12(1) and (3) of the GDPR, as the Complainant's access
request has not been dealt with in due time.
However, due to the constellation explained above, the Company has
considered the response to the Complainant by
Poland, to be sufficient at that time. The Company apologised for this mistake
and immediately provided the requested information to the BW DPA which
forwarded them to the complainant accordingly. The information the Company
sent to the BW DPA and which the BW DPA then sent to the complainant
(once again, after his letter in March) states that the controller in fact has no
more information stored about the complainant. Every information about the
complainant has been deleted. This is the reason why the controller asked the
BW DPA to submit the information following the Article 15 request to the
complainant in the first place.
In addition, the Company has been very cooperative during the regulatory and
supervising process. After being requested by the BW DPA, the Company
immediately gave the requested information.
Hence, the BW DPA issues a reprimand to the company for the
abovementioned infringements of the GDPR, based on Article 58(2)(b) GDPR.
We will also reiterate to the Company again the fact that requests under
Articles 15-22 GDPR must be answered without undue delay, at the latest
within one month, and that the controller must implement internal processes
that ensure a response within this deadline.
The administrative proceedings against the Company are still on record, which
is why we reserve the right to impose a fine in the event of a further violation
by the Company.
V. Information on legal remedies
An appeal against this decision may be filed in writing, electronically or for
recording with the Administrative Court of Stuttgart, Augustenstraße 5, 70178
Stuttgart, within one month of notification pursuant to Article 78 of the General
Data Protection Regulation in conjunction with Section 20(1) and (3) of the
Federal Data Protection Act.
6